TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
Microsoft Threat Intelligence has uncovered a new variant of the ClickFix attack technique, dubbed TerminalFix, that tricks users into executing malicious PowerShell commands through fake Cloudflare CAPTCHA verification pages.
Unlike traditional ClickFix campaigns that typically direct victims toward the Windows Run dialog, TerminalFix specifically instructs users to open Windows Terminal or PowerShell and paste a supposedly legitimate verification command.
What begins as a simple CAPTCHA verification can ultimately give attackers persistent access to the victim's internal network through a custom reverse-tunnel backdoor.
What Is TerminalFix?
TerminalFix is a multi-stage attack campaign targeting organizations across multiple industries.
It combines social engineering with several post-compromise techniques, including:
- Fake Cloudflare CAPTCHA pages
- Malicious PowerShell execution
- DLL sideloading
- Steganographic payload delivery
- Active Directory reconnaissance
- Registry and scheduled-task persistence
- Encrypted WebSocket communications
- Reverse TCP tunneling
The campaign doesn't rely on a traditional software vulnerability to get the initial foothold.
Instead, the victim is manipulated into executing the attack themselves.
Microsoft describes TerminalFix as a particularly dangerous evolution of ClickFix because the use of Windows Terminal or PowerShell allows attackers to execute more complex, multi-line commands successfully.
How the Attack Works
TerminalFix follows a structured attack chain:
Initial Access
Attackers compromise legitimate websites and inject a fake Cloudflare Turnstile CAPTCHA overlay.
The fake verification page includes familiar Cloudflare branding and a "Verify you are human" prompt designed to appear legitimate.
When the victim interacts with the CAPTCHA, a malicious PowerShell command is copied to their clipboard.
The victim is then instructed to open Windows Terminal or PowerShell and paste the command.
Malware Deployment
The PowerShell command downloads a ZIP archive containing:
LockScreenContentServer.exe— a legitimate signed Windows executabledui70.dll— a malicious DLL
The files are extracted into a directory under C:\ProgramData.
The legitimate executable is then launched, causing Windows to load the malicious DLL through DLL sideloading.
Payload Extraction
The malicious DLL launches another PowerShell stage that downloads PNG images from attacker-controlled domains.
The images contain hidden malicious data embedded inside their pixel information.
The malware extracts this concealed information and reconstructs additional payloads on the compromised machine.
This technique is known as steganography.
Persistence & Reconnaissance
TerminalFix establishes persistence using:
- Registry Run keys
- Scheduled tasks
- Hidden directories
It then begins collecting information about the victim's environment, including domain trusts, domain administrators, Active Directory users and computers, and reachable internal servers.
Reverse Tunnel
Finally, the campaign deploys a Python-based tunneling implant named client.py.
The implant establishes an encrypted WebSocket connection to attacker infrastructure over port 443 and can proxy arbitrary TCP traffic through the compromised machine.
This effectively turns the infected endpoint into a network pivot point.
Why This Is Concerning
The most dangerous part of TerminalFix isn't the fake CAPTCHA itself.
It's what the attacker can do after the victim executes the command.
The reverse tunnel can allow attackers to communicate with systems that are not directly exposed to the internet but are reachable from the compromised workstation.
Microsoft observed the malware performing extensive reconnaissance, including:
- Domain trust discovery
- Domain administrator enumeration
- Active Directory user searches
- Active Directory computer searches
- System information collection
- Targeted server discovery
- Ping sweeps across internal infrastructure
This gives attackers a map of the environment before potentially moving deeper into the network.
Microsoft did not observe the later-stage actions in the analyzed chain, but warned that the access could potentially be used for privilege escalation, disabling security controls, data theft, lateral movement, or ransomware deployment.
Who Is at Risk?
TerminalFix primarily presents a risk to organizations whose employees can browse compromised websites and execute commands on Windows endpoints.
Higher-risk environments include:
- Organizations with unrestricted PowerShell access
- Windows endpoints without strong application controls
- Domain-joined employee workstations
- Networks with weak segmentation
- Organizations lacking detailed PowerShell logging
- Environments where users have excessive privileges
The risk becomes significantly greater when a compromised workstation can communicate broadly with internal servers and administrative infrastructure.
The Reverse Tunnel Changes the Game
Traditional malware often focuses on stealing information from the infected computer.
TerminalFix goes further.
Its reverse-tunnel implant can allow the attacker to use the compromised computer as a bridge into the organization's internal network.
The basic architecture looks like:
Attacker Infrastructure
↓
Encrypted WebSocket Tunnel
↓
Compromised Windows Endpoint
↓
Internal Network
↓
Reachable Servers & Services
The implant's SOCKS-style TCP proxy functionality means the attacker can potentially instruct the compromised host to connect to other systems visible from its network position.
That makes a single compromised workstation potentially much more valuable than the data stored on that workstation itself.
Defensive Recommendations
Microsoft recommends organizations implement layered controls to reduce exposure to TerminalFix and similar ClickFix campaigns.
User Awareness
Train employees to recognize fake CAPTCHA pages that instruct them to:
- Open PowerShell
- Open Windows Terminal
- Press
Win + R - Copy commands
- Paste scripts
- Execute "verification" commands
A legitimate CAPTCHA should never require a user to execute a PowerShell command.
PowerShell Controls
Organizations should restrict PowerShell execution for standard users where practical through controls such as:
- AppLocker
- Windows Application Control
- Group Policy
- PowerShell Constrained Language Mode
PowerShell Script Block Logging should also be enabled to provide visibility into suspicious or obfuscated commands.
DLL Sideloading Detection
Security teams should monitor for legitimate signed executables launching from unusual directories and loading unexpected DLLs.
In particular, defenders should investigate instances of LockScreenContentServer.exe executing outside its expected Windows system location.
Network Monitoring
Monitor for unusual outbound encrypted connections, particularly endpoints establishing persistent WebSocket communications with unfamiliar infrastructure.
Organizations should also investigate endpoints performing unexpected internal network discovery or communicating with large numbers of internal systems.
Persistence Monitoring
Security teams should regularly monitor:
- Registry Run keys
- Scheduled tasks
- Hidden directories
- Unexpected PowerShell scripts
- Newly created executables and DLLs
Finding one of these artifacts should trigger investigation into the complete execution chain rather than simply deleting the suspicious file.
The Bigger Picture: ClickFix Is Evolving
TerminalFix demonstrates how the ClickFix technique is moving beyond simple malware delivery.
The attack combines:
- Social engineering to obtain execution
- PowerShell for flexible scripting
- DLL sideloading for defense evasion
- Steganography for concealed payload delivery
- Active Directory reconnaissance for internal discovery
- Persistence mechanisms for continued access
- Reverse tunneling for network-level access
The result is a multi-stage intrusion that begins with something as ordinary-looking as a CAPTCHA.
That is what makes the technique particularly effective.
The attacker doesn't have to break through the front door if they can convince someone inside the organization to open it.
Final Takeaway
TerminalFix is a reminder that social engineering can be just as dangerous as software exploitation.
A fake Cloudflare CAPTCHA may look like a harmless security check, but in this campaign it becomes the starting point for PowerShell execution, malware deployment, persistence, Active Directory reconnaissance, and ultimately a reverse tunnel into the victim's network.
The biggest lesson for organizations is simple:
Never trust a webpage that tells you to paste a command into PowerShell or Windows Terminal to prove you're human.
Because in TerminalFix, the CAPTCHA isn't checking whether you're a human.
It's checking whether you'll execute the attack for them.
Related articles
Comments (0)
No comments yet — be the first.